diff options
| author | Andrey Konovalov <andreyknvl@gmail.com> | 2025-10-22 00:25:45 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-29 14:01:22 +0100 |
| commit | 4c6bddf55a2ca27087a5fb2e40e144a8765aa470 (patch) | |
| tree | 531566ddebe0316e0c374b79608c7f85a9b9d7f2 | |
| parent | c0d920f082c4a15c9926c6a603ec3de48e82c523 (diff) | |
| download | linux-4c6bddf55a2ca27087a5fb2e40e144a8765aa470.tar.gz linux-4c6bddf55a2ca27087a5fb2e40e144a8765aa470.tar.bz2 linux-4c6bddf55a2ca27087a5fb2e40e144a8765aa470.zip | |
usb: raw-gadget: do not limit transfer length
commit 37b9dd0d114a0e38c502695e30f55a74fb0c37d0 upstream.
Drop the check on the maximum transfer length in Raw Gadget for both
control and non-control transfers.
Limiting the transfer length causes a problem with emulating USB devices
whose full configuration descriptor exceeds PAGE_SIZE in length.
Overall, there does not appear to be any reason to enforce any kind of
transfer length limit on the Raw Gadget side for either control or
non-control transfers, so let's just drop the related check.
Cc: stable <stable@kernel.org>
Fixes: f2c2e717642c ("usb: gadget: add raw-gadget interface")
Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
Link: https://patch.msgid.link/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/gadget/legacy/raw_gadget.c | 2 |
1 files changed, 0 insertions, 2 deletions
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c index 72ecce73ab53..d9cbbde8ff59 100644 --- a/drivers/usb/gadget/legacy/raw_gadget.c +++ b/drivers/usb/gadget/legacy/raw_gadget.c @@ -619,8 +619,6 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr, return ERR_PTR(-EINVAL); if (!usb_raw_io_flags_valid(io->flags)) return ERR_PTR(-EINVAL); - if (io->length > PAGE_SIZE) - return ERR_PTR(-EINVAL); if (get_from_user) data = memdup_user(ptr + sizeof(*io), io->length); else { |